RHSA-2026:93466: Important: libsoup security update
The libsoup packages provide an HTTP client and server library for GNOME.Security Fix(es): libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556) libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557) libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558) libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libsoupto a version that resolves this vulnerability.Fixed in 2.62.3-3.el8_8.15 - Upgrade
Upgrade
redhat/libsoup-debuginfoto a version that resolves this vulnerability.Fixed in 2.62.3-3.el8_8.15 - Upgrade
Upgrade
redhat/libsoup-debugsourceto a version that resolves this vulnerability.Fixed in 2.62.3-3.el8_8.15 - Upgrade
Upgrade
redhat/libsoup-develto a version that resolves this vulnerability.Fixed in 2.62.3-3.el8_8.15
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize applications that use libsoup and process WebSocket traffic. The listed fixes affect WebSocket Pong handling, message reassembly, receive-buffer growth, and client-frame masking.
Do the reported flaws affect only one WebSocket code path?
No. The advisory lists four separate heap buffer overflow issues across distinct WebSocket processing operations, so remediation should cover the updated libsoup packages rather than focusing on a single message type or buffer-handling path.